Ethereum Node Clients Patch Critical Certificate Vulnerability

The security threat stems from weak cryptographic keys associated with eight intermediate certificate authorities managed by eMudhra. Researchers discovered that these keys were generated with insufficient randomness, allowing them to be mathematically recovered. Because Java, the language underpinning both Teku and Besu, does not check certificate revocation status by default, these compromised certificates remained trusted by node software even after eMudhra formally revoked them on October 18.

Attackers could exploit this by intercepting HTTPS connections between a validator and its external services, such as beacon nodes or block builders. By presenting a forged certificate, an attacker could manipulate block proposals, potentially diverting transaction fees to their own addresses. Teku developers clarified that default mainnet configurations remain unaffected and no active exploitation has been reported to date.

Operators utilizing Docker images for Teku and Besu received the necessary fixes in versions 26.10.3 and 26.10.2, respectively. However, those running standalone binary distributions must manually update their Java runtime environments. Teku specifically warned that users on Java 26 must migrate to Java 25 to receive the required security patches, as the former has reached its end-of-life cycle.